Commercially available computer protection solutions (such as antivirus software or firewalls) can prevent a limited set of malwares from compromising a computer (or a network of computers). However, these solutions cannot be guaranteed to provide a full protection against an external attack by a professional hacker that can use actions and signatures different from the known set of malwares, or even introduce a Trojan malware from within the computer network. However, overcoming the available protection solutions requires hacking skills. The operation of the hacker corresponds to specific targets the hacker tries to penetrate, and someone that is not a professional hacker cannot use similar methods.
A typical vulnerabilities analysis (intended to locate weaknesses in the network) carried out by organizations includes employing an external penetration test by an “ethical” hacker. Only very large organizations can afford employment of an internal ethical hacker. The ethical hacker gains internal access to the network of the organization (without receiving any passwords) and simulates an attack of a malicious hacker in order to locate vulnerabilities in the organization.
For example, an organization with a network with about a hundred users typically has fifteen servers and it would take about four working days for an ethical hacker to check vulnerabilities at all of these servers. Since the organization usually has a limited budget for such tests, the ethical hacker is limited by time (sometimes resulting in incomplete tests). Furthermore, the organization sometimes can even expose weak points to the ethical hacker in order to save time.
As there is no guarantee that the “ethical” hacker will not perform malicious actions or steal information, there is therefore a need for a solution that does not involve employing an external hacker.